v0.2.0 — CFG attestation, JOP detection & evaluation harness

What's new since v0.1.0

Detector

• CFG-edge validation — every direct/conditional branch is checked against the statically recovered CFG; off-graph edges are flagged immediately.
• Hash-chain attestation (C-FLAT style) — each transfer is folded into a running FNV-1a 64-bit hash; the token is printed at exit for offline comparison against a known-good baseline.

Attacks

• 03-jop/ — JOP PoC: a blr-pivot chain caught at the first illegal indirect-call target (100% detection, 2.23× overhead).
• 04-data-only/ — Non-control-data PoC: flips an adjacent is_admin flag without touching any return address. Documents the L1 gap.

Evaluation harness (tools/run_eval.py)

• Repeats each case N times, writes per-run CSVs to eval/raw/<date>/, and renders a summary with detection rate, FPR, overhead, and time-to-detection.
• Payload pre-generation decouples pwntools startup from timing; --measure-pwn-startup measures it separately.

Headline results (N=50, Raspberry Pi 4 / Cortex-A72)

Attack	Detection	FPR	Overhead
Stack BOF	100%	0%	2.41×
ROP	100%	0%	2.65×
JOP	100%	0%	2.23×
Non-control-data (L1 gap)	0% ✓	0%	3.13×

Next

L2 data-provenance tracking and L3 object-bounds checking.